Lesson 1.1d: Access Points

An Access Point (AP) is the component that brings wireless devices into a wired LAN. If a router decides how traffic moves between networks and a switch forwards frames inside a LAN, an AP acts as the bridge between 802.11 wireless traffic and 802.3 Ethernet.

In enterprise designs, an AP usually does not act as the main default gateway, NAT device, or DHCP server. Its primary job is to provide wireless access, bridge traffic into the wired network, and enforce WLAN-related policy.

1. What is an Access Point?

1.1 Core role of an AP

An Access Point commonly does the following:

• Advertises a WLAN so wireless clients can discover and join it.
• Receives wireless frames and bridges them into the wired Ethernet side.
• Maps traffic from SSIDs to the correct VLAN or policy.
• Applies Wi-Fi security such as WPA2/WPA3.
• Supports roaming when several APs serve the same WLAN.

Simple topology:

1

Laptop/Phone )))) AP ---- Switch ---- Router/Firewall ---- Internet

Key idea: An AP does not replace a router. The AP provides wireless access; the router still handles inter-network forwarding.

1.2 Which OSI layers matter?

From an OSI point of view, APs are tied mainly to:

• Layer 1: sending and receiving radio signals.
• Layer 2: handling frames, MAC addresses, SSID/BSSID, and bridging traffic between Wi-Fi and Ethernet.

In short, an AP is primarily a Layer 1 and Layer 2 access device, not a full routing platform.

2. Key wireless terms

2.1 SSID

SSID (Service Set Identifier) is the Wi-Fi network name users see in their wireless network list.

Examples:

• Company-WiFi
• Guest-WiFi
• IoT-WiFi

One AP can advertise one or multiple SSIDs. In enterprise networks, each SSID usually represents a different access policy.

2.2 BSSID

BSSID (Basic Service Set Identifier) identifies a specific wireless cell, usually tied to the MAC address of the radio or interface advertising a given SSID.

Important distinction:

• SSID = the Wi-Fi name users recognize.
• BSSID = the technical identifier of the exact AP/radio a client is associated with.

Example for the same SSID Company-WiFi:

• AP1 BSSID AA:AA:AA:AA:AA:01
• AP2 BSSID AA:AA:AA:AA:AA:02
• AP3 BSSID AA:AA:AA:AA:AA:03

2.3 BSS and ESS

BSS (Basic Service Set) is the coverage cell of one AP/radio and the clients attached to it.

ESS (Extended Service Set) is a group of BSSs that share the same SSID and are connected through the same distribution system, creating wider coverage.

So:

• One AP cell = one BSS
• Several APs using the same SSID = one ESS

2.4 Roaming

Roaming is the process of a client moving from one AP to another within the same ESS.

Example:

• In the lobby, the client uses AP1
• In the hallway, it moves to AP2
• In a meeting room, it moves to AP3

The most important thing to remember:

• The SSID can stay the same
• The BSSID changes

The goal is to keep connectivity as seamless as possible, although roaming still depends on client behavior, signal quality, channel planning, and WLAN consistency.

Simulation: BSS, ESS, and roaming between APs

3. How does an AP connect to the wired network?

Most enterprise APs uplink to a switch over Ethernet.

1

AP ---- Ethernet ---- Switch

From there, traffic continues toward routers, firewalls, WLCs, or internal services.

3.1 Access port

If the AP serves a simple design or a single user network, the switch uplink can be configured as an access port.

Example:

• SSID Company-WiFi
• All client traffic enters VLAN 10

3.2 Trunk port

When the AP advertises multiple SSIDs and each maps to a different VLAN, the uplink is commonly an 802.1Q trunk.

Example:

• Company-WiFi → VLAN 10
• Guest-WiFi → VLAN 20
• IoT-WiFi → VLAN 30

That means the AP-switch link must carry multiple VLANs over the same physical cable.

A simple way to picture it: one SSID does not always require one VLAN, but SSID-to-VLAN mapping is a very common way to separate traffic.

3.3 PoE on APs

Many enterprise APs use PoE (Power over Ethernet) so the same Ethernet cable carries:

• Data
• Power

Real-world benefits:

• No nearby wall outlet is required.
• APs are easier to mount on ceilings or walls.
• Power can be managed centrally from the switch or injector.
• A UPS-backed switch can keep APs online during short power loss events.

Simulation: Access Point uplink, SSID, and VLAN mapping

4. Bands, channels, and coverage

4.1 Common Wi-Fi bands

Modern APs can operate on:

• 2.4 GHz
• 5 GHz
• 6 GHz

In practice, these bands are usually compared like this:

4.2 2.4 GHz channels

In basic wireless design, the three commonly referenced non-overlapping channels are:

• 1
• 6
• 11

Poor channel planning can cause:

• Co-channel interference
• Reduced performance
• Worse roaming behavior

4.3 What affects roaming quality?

Good roaming is not only about adding more APs. It also depends on:

• Proper coverage design
• Channel and transmit-power planning
• Consistent SSID and security settings
• Centralized coordination if a controller/cloud system exists
• Client-side roaming decisions

Important nuance: In many cases, the client decides when to leave an AP. The AP or controller can assist, but not fully control the decision.

5. Wi-Fi security on an AP

5.1 WPA2/WPA3 Personal

This model uses a shared password (PSK - Pre-Shared Key). It is common for:

• Small networks
• Simple guest WLANs
• Environments that do not need user-by-user identity

5.2 WPA2/WPA3 Enterprise

This model commonly integrates with:

• 802.1X
• RADIUS server
• user accounts or certificates

The advantage is centralized per-user or per-device authentication instead of one shared password for everyone.

In simple terms: Personal uses one shared password, while Enterprise uses centralized identity-based authentication.

6. Access Point deployment models

6.1 Autonomous AP

An Autonomous AP runs independently.

Each AP keeps its own:

• SSIDs
• security settings
• VLAN mapping
• radio configuration

Advantages:

• Simple
• No separate controller required
• Good for small deployments

Limitations:

• Harder to manage at scale
• Repetitive per-device configuration
• Less centralized RF and roaming optimization

6.2 Lightweight AP and WLC

A Lightweight AP (LAP) is managed by a Wireless LAN Controller (WLC).

In this model:

• The AP focuses on wireless access
• The WLC centralizes WLAN configuration, policy, RF management, monitoring, and roaming behavior

Cisco lightweight APs use CAPWAP to communicate with the controller.

A simple distinction is:

• Autonomous AP = self-managed
• Lightweight AP = controller-managed
• CAPWAP = protocol between lightweight AP and WLC

6.3 Cloud-managed AP

Many modern networks also use cloud-managed APs.

Characteristics:

• Centralized management through a cloud dashboard
• Easier multi-branch deployment
• Useful for distributed organizations
• Management is centralized even though the AP still provides local radio access

6.4 Quick comparison

7. Access Point vs wireless router

Home users often call any Wi-Fi device a “wireless router,” but the functions are different:

In enterprise networks:

• The AP is usually not the default gateway
• The AP usually does not perform NAT
• Those functions are commonly handled by a router, firewall, or Layer 3 switch

8. Quick recap

Access Point:

• Connects wireless clients to a wired LAN
• Bridges 802.11 and 802.3
• Operates mainly at Layer 1 and Layer 2
• Advertises one or more SSIDs
• Can map SSIDs to VLANs
• Commonly uplinks to a switch as access or trunk
• Often uses PoE
• Supports WPA2/WPA3
• Supports roaming in multi-AP deployments
• Can be autonomous, controller-based, or cloud-managed
• Uses CAPWAP in lightweight AP deployments

One-line memory aid: An Access Point is the device that turns Wi-Fi access into controlled Ethernet-side connectivity through SSIDs, security, VLANs, and roaming.

References:

• CCNA Exam v1.1 (Cisco)
• AP Connectivity to Controller - CAPWAP (Cisco)
• Service Set Identifiers (Cisco)
• VLAN Tagging on MR Access Points (Cisco Meraki)
• RF Channels on a Cisco Business Wireless Network (Cisco)